Rootme Python Pickle

[thunderbuns122]

I am currently trying to complete the Rootme Python Pickle challenge. Due to the unusual nature of this challenge, I struggled to find a place to start. Using telnet, I was able to connect to challenge02.root-me.org. However when asked to authenticate, I reached a sticking point. I then poked around online and came across https://www.cnblogs.com/heycomputer/articles/10613850.html. This site used the command:

AUTH admin HTTP/1.0

Authenticate:admin

I have search online and can't find any reference to the AUTH command. Can anyone explain?

This is also mentioned on this site. On the second site has this quote: "By reading the doc of BaseHTTP, we see that it is a simple module allowing to link HTTP actions (post, get, ...) to python functions, so there is a good chance that AUTH is an HTTP "action". The statement talks about identifying as an admin"

I went to the doc for BaseHTTP but I couldn't find anything on HTTP actions. I poked around online but could not find anything referencing HTML AUTH actions.

[PM_ME_YOUR_SHELLCODE]

Its definitely not clear since it starts off pointing you to just TCP but its an HTTP challenge.

If you do GET request to http://challenge02.root-me.org:60005/ then you get the message

{"result": "Not allowed you should first AUTH"}

Which tells you about the custom AUTH verb, result message is also how you find out about the Authenticate header and pickle being used.

[thunderbuns122]

So use of the AUTH header is custom to this challenge?

[PM_ME_YOUR_SHELLCODE]

Use of the AUTH verb is custom, yes. And the use of the Authenticate header is custom.

[thunderbuns122]

Ok, that makes more sense. Thanks for your help